CVE-2026-98704: wifi: mac80211: keep fallback association elements alive
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: keep fallback association elements alive
Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities.
When an association response omits WMM, HT, or VHT information, ieee80211assocconfiglink() parses the cached BSS IEs and copies the missing element pointers out of that fallback parse. For a non-transmitted MBSSID profile those pointers refer to merged-profile storage owned by the parse object, and the fallback block frees that object at its end. The copied pointers are used afterwards to determine the operating channel, configure bandwidth, and apply HT capabilities.
Keep the fallback parse result alive until association setup finishes.
[reorder variable declaration]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux systems using the mac80211 Wi-Fi stack may be exposed when they associate with a non-transmitted MBSSID profile. The affected path is reached when association-response information is missing and mac80211 falls back to cached BSS information.
What conditions are needed to trigger the vulnerable code path?
The association must be to a non-transmitted MBSSID profile, and the association response must omit WMM, HT, or VHT information. In that situation, mac80211 copies element pointers from fallback-parsed cached BSS IEs and later uses them after the parse object has been freed.
What can indicate that a system encountered this issue?
The available information identifies a use of freed memory during association setup, specifically while determining the operating channel, configuring bandwidth, or applying HT capabilities. It does not provide specific log messages, crash signatures, or detection commands.